[stir] Stephen Farrell's Discuss on draft-ietf-stir-passport-10: (with DISCUSS)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-stir-passport-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-stir-passport/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


Deterministic ECDSA (RFC6979) gets rid of a significant weakness
with ECDSA. IIRC when JOSE was done there was a feeling that adding a
MUST or SHOULD for that was tricky due to lack of support in
libraries. When we recently re-checked for COSE, the answer was
that today, it's ok to have that as a MUST or SHOULD. (If some
kind of FIPS-140 stuff precludes a MUST, then a "SHOULD unless
you're sad enough to be stuck having to pay lip lipservice to
FIPS-140" clause might be right. So the DISCUSS point here is:
given the real-world demonstrated weakness inherent in the need
for an RNG in ECDSA why didn't the WG choose to at least RECOMMEND
deterministic ECDSA? (Or better, make it a MUST.)

If the answer is: "we thought about it [ref] and decided to not require
deterministic" then I'll clear. But even if the WG did consider it
a couple of years ago, the situation may have changed so a quick
re-think might be worthwhile.